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Respectfully to: Ministry of Public Security 
Department of Cyber Security and Hi-tech Crime Prevention and Control (A05) 
No. 40A Hang Bai, Hang Bai Ward, Hoan Kiem District, Hanoi 


BSA COMMENTS ON DRAFT DECREE ON PERSONAL DATA PROTECTION 


Dear Sirs, 


We, BSA | The Software Alliance (BSA), appreciate the opportunity to provide comments in 
response to Vietnam’s Draft Decree on Personal Data Protection. 


BSA members’? are enterprise solutions providers that create the technology products and 
services that power other businesses. They offer tools including cloud storage services, 
customer relationship management software, human resources management programs, identity 
management services, and collaboration software. These enterprise software companies are in 
the business of providing privacy-protective technology products, and their business models do 
not depend on monetizing users’ data. BSA members all recognize that companies must earn 
consumers’ trust and act responsibly with their personal data. 


BSA supports Ministry of Public Security efforts to promote robust personal data protection 
through a legal framework that is flexible, fosters innovation, and better enables international 
data transfers. As Vietnam considers the development of a Decree on Personal Data 
Protection, it is important to identify global best practices on personal data privacy and 
protection. 


BSA supports the implementation of frameworks that increase the transparency of personal 
data collection and use; enable and respect informed choices by providing governance over 
that collection and use; provide consumers with control over their personal data; provide robust 
security; and promote the use of data for legitimate business purposes. We have developed a 
set of Global Privacy Best Practices,? outlining elements which we strongly suggest be taken 
into consideration as part of your efforts. The BSA "Global Privacy Best Practices" can serve as 
useful guidelines to ensuring personal data protections are consistent with consumers’ 
expectations, while also enabling companies to pursue legitimate business interests. 





1 BSA’s members include: Adobe, Amazon Web Services, Atlassian, Autodesk, AVEVA, Bentley Systems, 

Box, Cadence, Cisco, CNC/Mastercam, IBM, Informatica, Intel, MathWorks, Microsoft, Okta, Oracle, PTC, 
Salesforce, ServiceNow, Siemens Industry Software Inc., Sitecore, Slack, Splunk, Synopsys, Trend Micro, 
Trimble Solutions Corporation, Twilio, and Workday. 


2 https://www.bsa.org/files/policy-filings/2018 BSA Global Privacy Best Practices.pdf 
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In addition to this, BSA has recently released a paper discussing the role of controllers and 
processors in privacy legislation.? This paper emphasizes the importance of distinguishing 
between controllers and processors and how doing this helps protect consumer privacy from a 
practical perspective. 


Because the ability to transfer data internationally is the lifeblood of the modern digital 
economy, we would like to particularly highlight the importance of a framework that allows 
companies to responsibly transfer data outside Vietnam. 


If the cross-border transfer of personal data is limited in the form of data localization or other 
highly restrictive requirements, those limitations will not only restrain the advancement of data 
protection goals, but also and trigger unintended consequences. They disrupt companies’ 
operations and make it costlier to provide services in Vietnam, even if that is not the intent, 
effectively depriving end-users in Vietnam of advanced services and putting them ata 
competitive disadvantage compared with companies in other countries. For these reasons and 
those explained in the attached paper, which clarify various misconceptions about data 
localization, we strongly recommend that the Ministry of Public Security avoid these measures. 


We truly appreciate the opportunity to share these initial views and we hope our comments will 
be helpful as the Ministry of Public Security considers its next steps on the Decree on Personal 
Data Protection. This would help promote a robust data protection environment in Vietnam, 
while allowing responsible stewardship of data to continue benefiting the Vietnamese citizens 
and Vietnam’s economy. 


We hope that our comments will help the Ministry of Public Security as you further debate, draft 
and prepare the Bill for enactment. 


We would like to thank you once again for taking time to discuss this important issue with BSA. 
Please do not hesitate to contact with any questions or comments which you might have. 


Thank you for your time and consideration. 


Sincerely, 


DIL) 


Jared William Ragland, Ph.D. 
Senior Director, Policy — APAC 








3 The Global Standard: Distinguishing Between Controllers and Processors in Privacy Legislation - 
https://www.bsa.orgq/files/policy-filings/03032020controllerprocessor.pdf 
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